@fuzdev/fuz_app 0.55.0 → 0.57.0

package/dist/auth/admin_action_specs.d.ts

@@ -17,11 +17,17 @@
  */
 import { z } from 'zod';
 import type { RequestResponseActionSpec } from '../actions/action_spec.js';
-/** Max audit-log page size. Mirrors the former REST route's clamp. */
+/** Max audit-log page size. */
 export declare const AUDIT_LOG_LIST_LIMIT_MAX = 200;
+/** Default `admin_account_list` page size. */
+export declare const ADMIN_ACCOUNT_LIST_DEFAULT_LIMIT = 50;
+/** Max `admin_account_list` page size. */
+export declare const ADMIN_ACCOUNT_LIST_LIMIT_MAX = 200;
 /** Input for `admin_account_list`. */
 export declare const AdminAccountListInput: z.ZodObject<{
     acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+    limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
 }, z.core.$strict>;
 export type AdminAccountListInput = z.infer<typeof AdminAccountListInput>;
 /** Output for `admin_account_list`. */
@@ -40,9 +46,10 @@ export declare const AdminAccountListOutput: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             name: z.ZodString;
         }, z.core.$strict>>;
-        permits: z.ZodArray<z.ZodObject<{
+        role_grants: z.ZodArray<z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             role: z.ZodString;
+            scope_kind: z.ZodNullable<z.ZodString>;
             scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             created_at: z.ZodString;
             expires_at: z.ZodNullable<z.ZodString>;
@@ -51,6 +58,7 @@ export declare const AdminAccountListOutput: z.ZodObject<{
         pending_offers: z.ZodArray<z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             role: z.ZodString;
+            scope_kind: z.ZodNullable<z.ZodString>;
             scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             from_username: z.ZodString;
@@ -143,15 +151,15 @@ export declare const AuditLogListOutput: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type AuditLogListOutput = z.infer<typeof AuditLogListOutput>;
-/** Input for `audit_log_permit_history`. */
-export declare const AuditLogPermitHistoryInput: z.ZodObject<{
+/** Input for `audit_log_role_grant_history`. */
+export declare const AuditLogRoleGrantHistoryInput: z.ZodObject<{
     limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
-export type AuditLogPermitHistoryInput = z.infer<typeof AuditLogPermitHistoryInput>;
-/** Output for `audit_log_permit_history`. */
-export declare const AuditLogPermitHistoryOutput: z.ZodObject<{
+export type AuditLogRoleGrantHistoryInput = z.infer<typeof AuditLogRoleGrantHistoryInput>;
+/** Output for `audit_log_role_grant_history`. */
+export declare const AuditLogRoleGrantHistoryOutput: z.ZodObject<{
     events: z.ZodArray<z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         seq: z.ZodNumber;
@@ -171,7 +179,7 @@ export declare const AuditLogPermitHistoryOutput: z.ZodObject<{
         target_username: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
-export type AuditLogPermitHistoryOutput = z.infer<typeof AuditLogPermitHistoryOutput>;
+export type AuditLogRoleGrantHistoryOutput = z.infer<typeof AuditLogRoleGrantHistoryOutput>;
 /** Input for `invite_create`. At least one of `email` / `username` must be provided. */
 export declare const InviteCreateInput: z.ZodObject<{
     email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
@@ -261,11 +269,15 @@ export declare const admin_account_list_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
     input: z.ZodObject<{
         acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+        limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     }, z.core.$strict>;
     output: z.ZodObject<{
         accounts: z.ZodArray<z.ZodObject<{
@@ -282,9 +294,10 @@ export declare const admin_account_list_action_spec: {
                 id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 name: z.ZodString;
             }, z.core.$strict>>;
-            permits: z.ZodArray<z.ZodObject<{
+            role_grants: z.ZodArray<z.ZodObject<{
                 id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 role: z.ZodString;
+                scope_kind: z.ZodNullable<z.ZodString>;
                 scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
                 created_at: z.ZodString;
                 expires_at: z.ZodNullable<z.ZodString>;
@@ -293,6 +306,7 @@ export declare const admin_account_list_action_spec: {
             pending_offers: z.ZodArray<z.ZodObject<{
                 id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 role: z.ZodString;
+                scope_kind: z.ZodNullable<z.ZodString>;
                 scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
                 from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 from_username: z.ZodString;
@@ -310,7 +324,9 @@ export declare const admin_session_list_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
     input: z.ZodObject<{
@@ -334,7 +350,9 @@ export declare const admin_session_revoke_all_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{
@@ -354,7 +372,9 @@ export declare const admin_token_revoke_all_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{
@@ -374,7 +394,9 @@ export declare const audit_log_list_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
     input: z.ZodObject<{
@@ -412,12 +434,14 @@ export declare const audit_log_list_action_spec: {
     async: true;
     description: string;
 };
-export declare const audit_log_permit_history_action_spec: {
+export declare const audit_log_role_grant_history_action_spec: {
     method: string;
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
     input: z.ZodObject<{
@@ -453,7 +477,9 @@ export declare const invite_create_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{
@@ -482,7 +508,9 @@ export declare const invite_list_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
     input: z.ZodObject<{
@@ -509,7 +537,9 @@ export declare const invite_delete_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{
@@ -528,7 +558,9 @@ export declare const app_settings_get_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
     input: z.ZodObject<{
@@ -550,7 +582,9 @@ export declare const app_settings_update_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{

package/dist/auth/admin_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAczE,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAI5C,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;kBAEhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;kBAEhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,mGAAmG;AACnG,eAAO,MAAM,sBAAsB;;;;;;;;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;kBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;kBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;kBAuB5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,mCAAmC;AACnC,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;kBAYrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAEtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,wFAAwF;AACxF,eAAO,MAAM,iBAAiB;;;;kBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,+BAA+B;AAC/B,eAAO,MAAM,eAAe;;kBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;;;;;;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,iCAAiC;AACjC,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,oCAAoC;AACpC,eAAO,MAAM,mBAAmB;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,qCAAqC;AACrC,eAAO,MAAM,oBAAoB;;;;;;;kBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;;;;;;kBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAI9E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAEtC,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;CAWV,CAAC;AAEtC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUF,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUZ,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAUJ,CAAC;AAEtC,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;CAWP,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,yBAAyB,CAYnE,CAAC"}
+{"version":3,"file":"admin_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAgBzE,+BAA+B;AAC/B,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,8CAA8C;AAC9C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AACnD,0CAA0C;AAC1C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAIhD,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;;kBAYhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;kBAEhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,mGAAmG;AACnG,eAAO,MAAM,sBAAsB;;;;;;;;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;kBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;kBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;kBAuB5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,mCAAmC;AACnC,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,gDAAgD;AAChD,eAAO,MAAM,6BAA6B;;;;kBAYxC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,iDAAiD;AACjD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;kBAEzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wFAAwF;AACxF,eAAO,MAAM,iBAAiB;;;;kBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,+BAA+B;AAC/B,eAAO,MAAM,eAAe;;kBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;;;;;;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,iCAAiC;AACjC,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,oCAAoC;AACpC,eAAO,MAAM,mBAAmB;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,qCAAqC;AACrC,eAAO,MAAM,oBAAoB;;;;;;;kBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;;;;;;kBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAI9E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAEtC,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;CAWV,CAAC;AAEtC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUF,CAAC;AAEtC,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;CAUJ,CAAC;AAEtC,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;CAWP,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,yBAAyB,CAYnE,CAAC"}

package/dist/auth/admin_action_specs.js

@@ -18,16 +18,32 @@
 import { z } from 'zod';
 import { Uuid } from '@fuzdev/fuz_util/id.js';
 import { ROLE_ADMIN, RoleName } from './role_schema.js';
-import { ActingActor, AdminAccountEntryJson, Email, Username } from './account_schema.js';
-import { AdminSessionJson, AUDIT_LOG_DEFAULT_LIMIT, AuditEventTypeName, AuditLogEventWithUsernamesJson, AuditOutcome, PermitHistoryEventJson, } from './audit_log_schema.js';
+import { AdminAccountEntryJson } from './account_schema.js';
+import { Email, Username } from '../primitive_schemas.js';
+import { ActingActor } from '../http/auth_shape.js';
+import { AdminSessionJson, AUDIT_LOG_DEFAULT_LIMIT, AuditEventTypeName, AuditLogEventWithUsernamesJson, AuditOutcome, RoleGrantHistoryEventJson, } from './audit_log_schema.js';
 import { InviteJson, InviteWithUsernamesJson } from './invite_schema.js';
 import { AppSettingsWithUsernameJson } from './app_settings_schema.js';
-/** Max audit-log page size. Mirrors the former REST route's clamp. */
+/** Max audit-log page size. */
 export const AUDIT_LOG_LIST_LIMIT_MAX = 200;
+/** Default `admin_account_list` page size. */
+export const ADMIN_ACCOUNT_LIST_DEFAULT_LIMIT = 50;
+/** Max `admin_account_list` page size. */
+export const ADMIN_ACCOUNT_LIST_LIMIT_MAX = 200;
 // -- Input/output schemas ---------------------------------------------------
 /** Input for `admin_account_list`. */
 export const AdminAccountListInput = z.strictObject({
     acting: ActingActor,
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(ADMIN_ACCOUNT_LIST_LIMIT_MAX)
+        .nullish()
+        .meta({
+        description: `Max accounts to return (default ${ADMIN_ACCOUNT_LIST_DEFAULT_LIMIT}, max ${ADMIN_ACCOUNT_LIST_LIMIT_MAX}).`,
+    }),
+    offset: z.number().int().min(0).nullish().meta({ description: 'Pagination offset.' }),
 });
 /** Output for `admin_account_list`. */
 export const AdminAccountListOutput = z.strictObject({
@@ -95,8 +111,8 @@ export const AuditLogListInput = z.strictObject({
 export const AuditLogListOutput = z.strictObject({
     events: z.array(AuditLogEventWithUsernamesJson),
 });
-/** Input for `audit_log_permit_history`. */
-export const AuditLogPermitHistoryInput = z.strictObject({
+/** Input for `audit_log_role_grant_history`. */
+export const AuditLogRoleGrantHistoryInput = z.strictObject({
     limit: z
         .number()
         .int()
@@ -109,9 +125,9 @@ export const AuditLogPermitHistoryInput = z.strictObject({
     offset: z.number().int().min(0).nullish().meta({ description: 'Pagination offset.' }),
     acting: ActingActor,
 });
-/** Output for `audit_log_permit_history`. */
-export const AuditLogPermitHistoryOutput = z.strictObject({
-    events: z.array(PermitHistoryEventJson),
+/** Output for `audit_log_role_grant_history`. */
+export const AuditLogRoleGrantHistoryOutput = z.strictObject({
+    events: z.array(RoleGrantHistoryEventJson),
 });
 /** Input for `invite_create`. At least one of `email` / `username` must be provided. */
 export const InviteCreateInput = z.strictObject({
@@ -164,18 +180,18 @@ export const admin_account_list_action_spec = {
     method: 'admin_account_list',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: AdminAccountListInput,
     output: AdminAccountListOutput,
     async: true,
-    description: 'List all accounts with their actors, permits, and pending offers. Admin-only.',
+    description: 'List all accounts with their actors, role_grants, and pending offers. Admin-only.',
 };
 export const admin_session_list_action_spec = {
     method: 'admin_session_list',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: AdminSessionListInput,
     output: AdminSessionListOutput,
@@ -186,7 +202,7 @@ export const admin_session_revoke_all_action_spec = {
     method: 'admin_session_revoke_all',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: AdminSessionRevokeAllInput,
     output: AdminSessionRevokeAllOutput,
@@ -198,7 +214,7 @@ export const admin_token_revoke_all_action_spec = {
     method: 'admin_token_revoke_all',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: AdminTokenRevokeAllInput,
     output: AdminTokenRevokeAllOutput,
@@ -210,29 +226,29 @@ export const audit_log_list_action_spec = {
     method: 'audit_log_list',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: AuditLogListInput,
     output: AuditLogListOutput,
     async: true,
     description: 'List audit log events with optional filters. Admin-only.',
 };
-export const audit_log_permit_history_action_spec = {
-    method: 'audit_log_permit_history',
+export const audit_log_role_grant_history_action_spec = {
+    method: 'audit_log_role_grant_history',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
-    input: AuditLogPermitHistoryInput,
-    output: AuditLogPermitHistoryOutput,
+    input: AuditLogRoleGrantHistoryInput,
+    output: AuditLogRoleGrantHistoryOutput,
     async: true,
-    description: 'List permit grant and revoke events with usernames. Admin-only.',
+    description: 'List role_grant grant and revoke events with usernames. Admin-only.',
 };
 export const invite_create_action_spec = {
     method: 'invite_create',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: InviteCreateInput,
     output: InviteCreateOutput,
@@ -244,7 +260,7 @@ export const invite_list_action_spec = {
     method: 'invite_list',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: InviteListInput,
     output: InviteListOutput,
@@ -255,7 +271,7 @@ export const invite_delete_action_spec = {
     method: 'invite_delete',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: InviteDeleteInput,
     output: InviteDeleteOutput,
@@ -267,7 +283,7 @@ export const app_settings_get_action_spec = {
     method: 'app_settings_get',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: AppSettingsGetInput,
     output: AppSettingsGetOutput,
@@ -278,7 +294,7 @@ export const app_settings_update_action_spec = {
     method: 'app_settings_update',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: AppSettingsUpdateInput,
     output: AppSettingsUpdateOutput,
@@ -299,7 +315,7 @@ export const all_admin_action_specs = [
     admin_session_revoke_all_action_spec,
     admin_token_revoke_all_action_spec,
     audit_log_list_action_spec,
-    audit_log_permit_history_action_spec,
+    audit_log_role_grant_history_action_spec,
     invite_create_action_spec,
     invite_list_action_spec,
     invite_delete_action_spec,

package/dist/auth/admin_actions.d.ts

@@ -5,23 +5,23 @@
  *
  * - Account management: `admin_account_list`, `admin_session_list`,
  *   `admin_session_revoke_all`, `admin_token_revoke_all`.
- * - Audit log reads: `audit_log_list`, `audit_log_permit_history`.
+ * - Audit log reads: `audit_log_list`, `audit_log_role_grant_history`.
  * - Invite CRUD: `invite_create`, `invite_list`, `invite_delete`.
  * - App settings: `app_settings_get`, `app_settings_update` (registered only
  *   when `AdminActionOptions.app_settings` is provided — the mutable ref is
  *   owned by the server context and shared with signup middleware).
  *
  * The action specs themselves live in `auth/admin_action_specs.ts`. Mutations
- * emit matching audit events via `audit_log_fire_and_forget`.
+ * emit matching audit events via `deps.audit.emit`.
  *
  * Authorization is declared at the spec level (`auth: {role: 'admin'}`) so
  * the RPC dispatcher enforces it before the handler runs and the generated
- * surface accurately reports the requirement. `permit_revoke` in
- * `auth/permit_offer_actions.ts` uses the same spec-level pattern even though its
+ * surface accurately reports the requirement. `role_grant_revoke` in
+ * `auth/role_grant_offer_actions.ts` uses the same spec-level pattern even though its
  * sibling methods are authenticated-but-not-admin — the dispatcher checks
  * auth per-spec, so mixed-auth endpoints compose cleanly. Handler-level
  * gates are reserved for input-dependent elevation (e.g.
- * `permit_offer_list`/`_history` elevate to admin only when the caller
+ * `role_grant_offer_list`/`_history` elevate to admin only when the caller
  * passes an `account_id` other than their own — an input-dependent check
  * the spec can't express).
  *
@@ -30,13 +30,14 @@
 import { type RpcAction } from '../actions/action_rpc.js';
 import { type RoleSchemaResult } from './role_schema.js';
 import { type AppSettings } from './app_settings_schema.js';
-import type { AuditEmitDeps } from './deps.js';
+import type { RouteFactoryDeps } from './deps.js';
 /** Options for `create_admin_actions`. */
 export interface AdminActionOptions {
     /**
      * Role schema result from `create_role_schema()`. Defaults to builtin
-     * roles only. Used to derive `grantable_roles` (the `web_grantable`
-     * subset) returned by `admin_account_list`.
+     * roles only. Used to derive `grantable_roles` (the subset whose
+     * `RoleSpec.grant_paths` includes `'admin'`) returned by
+     * `admin_account_list`.
      */
     roles?: RoleSchemaResult;
     /**
@@ -49,24 +50,16 @@ export interface AdminActionOptions {
      */
     app_settings?: AppSettings;
 }
-/**
- * Dependencies for `create_admin_actions`.
- *
- * Aliases the shared `AuditEmitDeps` (the `log` / `on_audit_event` /
- * optional `audit_log_config` slice every audit-emitting site picks).
- * `log` drives RPC-internal error logging; `on_audit_event` is wired by
- * the two revoke-all mutations so SSE fan-out mirrors the former
- * REST-route behavior; `audit_log_config` is consumed by
- * `audit_log_fire_and_forget`.
- */
-export type AdminActionDeps = AuditEmitDeps;
 /**
  * Create the admin-only RPC actions.
  *
- * @param deps - `AdminActionDeps` slice of `AppDeps` (`log`, `on_audit_event`, optional `audit_log_config`)
+ * @param deps - `RouteFactoryDeps` (`log`, `audit`, …). `log` drives RPC-
+ *   internal error logging; `audit.emit` writes audit rows via the captured
+ *   pool. The bound emitter encapsulates `on_audit_event` fan-out and the
+ *   optional `AuditLogConfig`.
  * @param options - role schema for `grantable_roles` derivation
  * @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
  * @mutates `options.app_settings` ref - `app_settings_update` writes `open_signup`, `updated_at`, and `updated_by` so signup middleware reads without a DB round trip
  */
-export declare const create_admin_actions: (deps: AdminActionDeps, options?: AdminActionOptions) => Array<RpcAction>;
+export declare const create_admin_actions: (deps: Pick<RouteFactoryDeps, "log" | "audit">, options?: AdminActionOptions) => Array<RpcAction>;
 //# sourceMappingURL=admin_actions.d.ts.map

package/dist/auth/admin_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAA4C,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAEnG,OAAO,EAAuB,KAAK,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAuB7E,OAAO,EAAC,KAAK,WAAW,EAAC,MAAM,0BAA0B,CAAC;AAK1D,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,WAAW,CAAC;AA8C7C,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,eAAe,EACrB,UAAS,kBAAuB,KAC9B,KAAK,CAAC,SAAS,CA4RjB,CAAC"}
+{"version":3,"file":"admin_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAE7F,OAAO,EAGN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAuB1B,OAAO,EAAC,KAAK,WAAW,EAAC,MAAM,0BAA0B,CAAC;AAK1D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AA8ChD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAClC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,EAC7C,UAAS,kBAAuB,KAC9B,KAAK,CAAC,SAAS,CAgQjB,CAAC"}